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— The MAILING DATE of this communication appears on the cover sheet with the correspondence address — 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )|3 Responsive to connmunication(s) filed on 15 July 2004 . 
2b)M This action is FINAL. 2b)\3 This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Expa/te Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) 13 Claim(s) 1,3-7,9-1 3,1 5-1 8 and 24-29 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) 13 Claim(s) 1,3-7,9-13,15-18 and 24-29 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8)0 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

§)□ The specification is objected to by the Examiner. 

10)13 The drawing(s) filed on 15 July 2004 is/are: a)l3 accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or fomn PTO-152. 

Priority under 35 U.S.C, § 119 

12)n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * c)[J None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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Art Unit: 2132 

DETAILED ACTION 
Drawings 

1 . The amended drawings (Fig.1 ) are accepted by examiner. 

Response to Arguments 

2. Referring to claims 7, 10 and 25, the rejections under 35 U.S.C. 101 have been 
overcome by the amendment. 

3. Claims 2, 8, 14 and 19-23 have been canceled. Claim 29 has been added. 

4. Claims 1, 7, 13, 24-28 have been amended. Applicant's amendments of the 
instant claims reflect "the process identified from a plurality of processes each carried 
out by an executable file, the process including at least one process initiated by an 
application program selected from the group consisting of a network browser This 
limitation is addressed in the rejections herein. Applicant's amendments have 
necessitated the new ground(s) of rejection provided herein. 

5. Referring to the independent claims Applicant argues that Ranger offers no 
suggestion or teaching of a "process for accessing files". Examiner disagrees and point 
out that Ranger teaches the content analysis through a content inspection mechanism 
(see column 2, lines 25 - 28 and unit 1 8 in Fig 3). In addition to it, Ji also teaches 
identifying the process by determining whether the file is executable module. 

6. Applicant further argues that prior art does not teach "defining a plurality of 
extensions indicative of different types of files". Examiner points out that Ji teaches 
determining whether the file to be transferred is of a type that can contain viruses. This 
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step is preferably performed by checking the extension of the file name (see Ji column 
7, lines 35-40). 



Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. Claims 1,3-7, 9-13, 15 - 18 and 24 - 29 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Ranger (U.S. Patent No. 6.393.568 B1 ) in view of Ji (U.S. 
Patent No. 5.623.600). 

9. Referring to the instant claims, Ranger discloses a system with content analysis 
provision (see abstract and Figs. 1 and 3). Ranger teaches providing content analysis 
through a content inspection mechanism, such as detection of a computer virus using a 
virus detection algorithm based on determining whether digital input information is 
encrypted . The content inspection mechanism analyzes decrypted content for such 
things as virus patterns, keywords, unknown program format, or any other content 
based criteria. The system generates a decryption request to decrypt encrypted digital 
input information prior to applying content analysis, such as virus detection. In response 
to the decryption request, the system decrypts the encrypted information prior to content 
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analysis such as virus detection and applies a content analysis application, such as a 
virus detection algorithm (see abstract). 

1 0. Referring to the independent claims 1 , 7, 1 3, 1 9, 28 and 29, the limitation 
"identifying a process for accessing files" is met by the content analysis through a 
content inspection mechanism (see column 2, lines 25 - 28 and unit 18 in Fig 3). 
Ranger teaches that he content inspection mechanism analyzes content for such things 
as virus patterns, keywords, unknown program format, clearance labels or any other 
content based criteria. The actions are selected based on the result of the inspection for 
example removal of a detected virus, filtering out programs of unknown format or non- 
approved formats, flagging files containing specific key words for additional scrutiny, or 
other desired action (see column 2, lines 28-38), which meets the limitation "selecting 
virus detection actions based ate least in part on the process". The limitation 
"performing the virus detection actions on the files" is met by blocks 42 and 44 in Fig, 2 . 
Ranger teaches that the use of cryptographic application and virus detection 
application, which meet "executable files" recited in the instant claims. 

1 1 . Refernng to claims 5, 1 1 and 17, Ranger teaches determining whether digital 
input information is encrypted (see column 2, line 29), which meets the limitation " a file 
signature associated with the process". 

12. While Ranger teaches analyzing the files for key words or patterns, he does not 
explicitly teach that a process is identified from a plurality of processes each carried out 
by an executable file within a network browser or other application. Referring to the 
instant claims, Ji discloses a virus detection and removal apparatus (see abstract). Ji 
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teaches determining whether the file to be transferred is of a type that can contain 
viruses. This step is preferably performed by checking the extension of the file name . 
For example, .txt, .bmd, .pcx and .gif extension files indicate that the file is not likely to 
contain viruses while .exe, .zip, and .com extension files are of the type that often 
contain viruses (see column 7, lines 35-40). 

Therefore, at the time the invention was made, it would have been obvious to one of 
ordinary skill in the art to modify the content analyzer of Ranger by adding the 
functionality for checking whether the process for accessing the file is carried out by an 
executable file within an application as taught in Ji. One of ordinary skill in the art would 
have been motivated to modify the content analyzer by adding the functionality for 
checking whether the process for accessing the file is carried out by an executable file 
within an application as taught in Ji for scanning the files for viruses (see Ji abstract). 

13. Referring to claim 28, it is notoriously well known in the to use a virus scanning 
systems for preventing download of the infected files. One of ordinary skill in the art 
would have been motivated to scan for viruses and prevent download of the infected 
files in order to protect the system from the executable files representing the virus 
running on the system and eventually destroying it. 

14. Referring to the limitation "the process identified from a plurality of processes each 
carried out by an executable file, the process including at least one process initiated by 
an application program selected from the group consisting of a network browser Ji 
shows that files and programs are downloaded through the internet (see Fig. 6A). That 
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means that the programs will include browsers or other internet applications within 
them. 

15. Referring to claim 29, Ranger teaches determining whether digital input 
information is encrypted (see column 2, line 29), which meets the limitation " a file 
signature associated with the process". 

Conclusion 

1 6. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 
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Any inquiry concerning this connmunication or earlier connnriunications from the 
examiner should be directed to Grigory Gurshman whose telephone number is 
(571)272-3803. The examiner can nornnally be reached on 9 AM-5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (571)272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free). 
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Examiner 
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